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ix}^^ 1 ©X— < h*>— ^©-r v^— ^ 
lt^n^c:^2®5"— :r;i/tc. {i>?5:< i:^— ocD-r 

icl3<l^n;tfjsB6i>^ < h*)— o®>r ^'^^ b:rn 

-^ii®U>^7;bi. B5IB>'^•^y^7'^yrfflJe^^^^> h7 
- ^ §S ;^ X A © Hu f Bt" - r ;i/ tzSBtl ^ n tulB 'i> 

T JBfiS ^ n 5 i: * i^S: h -r s ii^JS 2 iBiScD S iftift 

g^s^XT^Af^itf^fiti. B(^lB>^^•^>^r^yrffiJe^J^^ 
b "7-^@Si^;^5^A>5?5^ *5f5cr)^j[£^^^*> ^'7- 
^ IfS >> ;^ X A CDSfJ § <• d h *if$aat i: -r S if* 
iSltC5B^(0gl!i^lB:??So 
[ii*^ 5 ] BU3B*3fe©ijE^®;^;. h y-^^WSS^ 

gS'>;^7^Ai)S. m^fB>^^''>^7^•yrfflJe^^l^;^^*> b •7- 
^ X A cot9;i!l ^^f t c i: ^ iRf^a i: f -5 ig^ 
Ji4tZ5Btg©Si!;ai0;^ffio 

[li^^6] H3eB^j[S:^^^>;/ h9-^g^i^>^7^A 
tfj aB/^ ^7 7 7"ffl icS^^^ 7 b 7 - ^ gS X A 
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s;^:^ btcS^l^fc7;^--;^b b i^^> b^:;b-XA* 
^V^T. tuIBiii^^^^^y b 7-^@liS/;^5^AhtyfB 
/^^^T^rffl/S^^^^y b7 — ^g3l^';^xACDM;?^ 

if^siht-'SIS^Jg 1 K:lBS8®@fiSI0:;?So 
[5i*JS7] buIB^jE^^^^ b7^-^^31>';;^5^A 
tctstt^lulBv^-S^i'— b i:. lulB/N'^y^ 
-y-jzrm^^W.^^)^ b C7-^gSi^;^7^Atc*>Mt-2>luaB 

if 6 {ciB«cD gafsia^iSo 

SSi^;^7^AtC:fe(tSBU5BJ: — S^aiV b:^'^^^^!^ b 

b^-^gSi^^^T^AtciJtt^fflcB^^^^i 
s ;^ 7^ >y r ^ ^ ^> W t- s d h -r -5 ii^Jg 

7t3iB«cDaa^l0:??^o 

hBljlB>''^7^r^vrffll2;;^^^^y b •7-^lfll'>y;7^ A 

(C t ^ T r£i4{b ^ nr I ^ ^ r ^ -r S ^ aJc 
6(C53^©ei!;ai0:^So 

[fS^J^lO] . BuIB^ii^^il^^^y b 9-^^11 i^:;^ 5^ 
A(3*5l:f^iSI^«SI(^tfem^. mJIB^iS^^^^ b7- 
^§Si^;:^5"ArtcDfrJ5BJl— Y^'7V:3L^ b^tS 
t^^b^-y-^y^T^^rii. Brj3B^JE£:^:^^^y b 

^-y'^;<7^^yri:. BufB^^7>:^7!yrmj!A^^^^y b 7 
30 — ^*gSi^;=^5^ArtcoBul3v^ — b^ 

>y b7 — ^W31t^;<7^AF*aCDHufB:ii — i^a:> b:^>^-^:ii 
^ b?:l^«ttfb^i^'^;^7^7ri:s frifB>'^7^T7rffi 
X£;^^^7 b7"-^lfllSx;^5^Ai:HuaB£t^^:^^ ^ b »7 
— ^lC:fettStufB{i^^ < 3CD;?^7 b^ — ^^J5KS 

^tior^iCs 3Aif— /t— (c omms e r ve r ) 
b4:ffil>TmJlB^2cD;?^^y b ^-^ii^y 

ttSitDTT-(i. BuIB^je^^^^y b ^-^^aii/^^^^A 
cObuIBv^ — i/i- — :t:ri;ai^ b h^ t5iB>'^'y^T\y r 
ffi/S^^^^y b r? — -i^g^i/j^T^AcOlufB:!^ — vol > b 
b ii^srSi^^b^nri^^c h*4$S[i:Ti>ii 
tCsBffi^ai&SIH^^ao 

[gi^Ji 1 1 J mmj^ vCf-rv y^mm.^w.^ ^ b 7 — 

^W^>;<7^Ai:g5fBJ[S^^^^y b 9 tc:j3{t -StulB 
{i>^^< i:4»-o(;D:?^7 b7-^«^^^i:cr)r^{c. fulB 
^2©^*y b9-^iimu >^^?&^U;/^tfe. B^JfB>'^•7 
^r^yrffij!^^^;^^ b 9-i7@S>';^7^Ai:. SulBJE^i 
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!7 - ^ 4 If s r ^ a i!i * «j X -5 ;^ 7^ r ^ ^ ^ {c w 
im^m 1 2 ] Busa*3fe©^j[£^^^ ^ hu-^mm 

^fejg 1 1 iZB^m(DSmmB:^^o 
(redundant) ^MV > ^^mxm^ti^ :i h 

^^»y h y-iJ^WSi^XT^AtziJCf^mJsBv^— i;i- — 
T-jymm.^m^^y hy-^if^v'^T^Atc^jit-SHuiB 

Hf^fB>'^•^>^7'^vrm/^:^:^^^y hy-^^ 
/N*->rr5^x^ b^fflV^TmilB^2CD^^y b^-^ilM 
7.y'AlZjr^\-r^mB&-^^-i^^-:tzri^:^^ht. HUlB 

im^m 1 6 1 H5IB>'^'^v^r *y :rffij[£^^^>y by- 
^lf31i/;<7^Ai:BuaB/A^M^ h 7 — ^ {c:fe(t-5ftjIB 
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h '7-^tC*3{t3BylB'J>^^< h^— ocD*\y h 9 — 
^«}fieM^i:©F^cDmjl3'J>^ < iisb— oco^^y b7-^ 

*y b 9 — i57^^$^:;^7^A35^^B5IB>'^^y rffllS^^ 
:f ^y h 7-<?'gSi/;^5^AJC. b?)IBJ[£^^^^> b^ — ^ 

* g s -r S S iO * W ») # ^ -5 ;^ 7^ r ^ ^ f> f ^ c 
i:*i^§ii:-r^HS^3l 1 5 tc|Bf2cDeE&ai0:^^o 

[is^js 1 7 1 B5aB**<D±i£^^^ ^y. h u-^mm 

m^mi ^\zmm(ommm.\Bi5mo 
m^^^\z\tuW}mB^'rxoti^(om,^m^ ^y b 7-^ 

ll^tLfc-r ^ *y brn bri;i/T V\^7.^^tsm 1 
b V' :^y'—y'JVt:^T ^^fl^^m^ b 9 — ^lf3ii 
i^>^7^Ah. 'J;^^ < i:t>— o(D$)^>:!)*btofBffi^ti5^-Y 

31v'>^7^Ai:. BuIB^/iC^J^^^y b7-^^lr31i^>?;7'A 
^BulB/i^^^^T^^y b9 — ^l::*5(:f^tufiB'>^< t^—o 

fiv>^T$>oT. BuiB^ itoT' bUy^T^-r^i/iciBti 

^ti7tmjtB'>5Sc < r:>©-r ^ ^y b :7'o b 

r YV7s\Z^':>Xm^^t\^^mi<D^-J b iJ 

30 ®r^CD^2CD^^y b'7-^3l(iU>^r-$)oT. mJlB^ 

2®T YV7^v'—':r)v\zum.'^nfzmt^^Pu < h t>— -3 

®$>^iCpl;i&l3i3i^n:i^-^^ V^^'-^^y brn b3;i/7- b 
i/;^lc<fc'PT*a^^n. tuiBije^^^^y b ^-^gs 

iy7.y'A<Dmmmizw^m^n^m2(D^^y hu-^mm 

^^^y b7-^©S>^>^7^AiCB!i3BJES^^^iy b7-^ 
^ @ S T s ^ fU ^ 5 [ § -a- s J: a b fc i: ^ 1^ ® h 
-r^J^^^^^^y b U — ^^mi^T.^'J^o 
im^m 1 9 1 iuIB^JCt^^^^^y b 9-^^315^;^ 7^ 
4^ AhBulB^^'*y^y^^y rffij£:^i^^^y b 9 — ^ If 31 f> ;< ^ 

tzzt^nmtT^m^mi s iz t^mojKwm^y b9 

immmz 0 1 ma^^^^y ^T^vymiu^m^y b 9- 
^SSi>';^7^A(Z)'f^i&^tc(i. fueB>'N-*y ^yrffljr^:^ 
^^^y b 9-^7gilSx;<7^A(i. BulBiiS^^^^y b 9 
- ^ gS ;^ -7^ A CD y ^ 51 1 <- c i: ^ ^ t- ^ if 

[11^X12 1] fijfB**(D3EJ[£^^:f >y b 9-^gS 
5(7 '>;^7^ A(7)0{I^ic(i. mt^:^^(D^^u^m^^y V^- 
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- 4^ W 31 >^ 7^ A © a fij $ 5 [ § iffi < C h * SS i: f S il 
A 0 ^ g^^r 5 A?) CD ft ^ ^ ^) {3 d X. . 

S ^ 2 ® a^tfeaiS i: ^ W ^ S C i: ^ItSt -r S 

^2©ffif?«iHi§i«i. g2©v^-i^i'-;^-:ri;x^ h 

ij|B^2(Z)T^-i^v-;t7^^^j:>^ h;5>sfSt4fb^n. mi 
^{3(±H?IB^2a)a:-S^aL> h7r:/£^*:c^ h AfStSt^fb^ 

[0 0 0 1 ] 

AtcHI-^o 
[0 0 0 2] 

[tEe*0fit^&] JCu^i^^^i^ h '7-<>S31>>>^5^A (BN 
MS) (i. JiimWLm^'&''\fi7.'T'J^ )V^^y VV-^ 

(B-isDN) p^(o^-j Yv-^m^mmcomw^m 
imm^m^^-Y (atm) ^v^^iatmv 

}v^zrv^^/n:y^iyY\y-^t^^^. iSM/ig^ 

ATMfi. B- I SDN^j^©4'^g^ff^^T^>'^^^y h 
[0 0 0 3] 

Si^y^rA (NMS) (C*5V^TffiPI*5^*b;^c^. ftP^ 
[0 0 0 4] gs&CDNMS. if^lZl3>tf i — <5^^»y h »7 
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[0 0 0 5] ^e>tc. CcDJ:d^^BBS^ig(C:feV^T> 
TCP/IP (iSMMaro bzi;u/^>^^-;f .y bT 
Dhzi;i.) y><>^t)#xfi. !"£ s t a b 1 i s hm 
ent of Isolated Failure I 
10 mmune Real-Time Cliannels 
in HARTSj 1 9 9 5 ^ 2 M^frs 1 1 3 - 1 1 
9M. *5J:tf TTCP/I P-Bas ed Data 
T r a n s p o r t S e r V i c e s for LAN 
/WAN Interconnectionj 1992 
^l^^n. 1 5 — 1 7M^53m^nTl>'5 tz. {£ 

[0 0 0 6] :$;^0^cD@fit3(i. mmmumm(o%^^ 
Mm<Dv yY^:^'mm^mh^tz Tc p/i p (mm^i 

#X.4ffl^AtVfc. BNMScO?t:i2)CD7;^— b 
>Y^tJ^mm-t^Zt^^:ho 

[0 0 0 8] ^^^cDS'jcoee^ti. ^^^sjjg-rsc: i: 

:&ST-t5x BNMSa)feA6£7):7 7»-— ;i/ b b b-^^ Mg;t? 
30 [0 0 0 9] 

mi^^t^nX'd^'^^y ^-r-j rfflB NMS ^cSt5c^-t^ 
0. §BNMStC:fe(tS^Mffl (bry^r-i/3>) 7^ 
— ^-y-— v'^— */rLTx >'^'^y ^T^;/r^BNMS<^T^— 
^^^— ;^;b5iBNMScD7^— ;^ ^^iDnm^m^-r 

b7-^ii®U >^ (NCL) ^^l^T:fe*). C 

^ildl-S (;^ii:;t(f. -^^^i^^. Cti,^cD^^t3^ 

if) o ^BNMS(3*5(t^a^^. SBNMS^jK^^ 

^.;;i.r7_^ (BN) hcomcommmm^^s^mzr^ 

':>Um'^\Z{t. ^r^y rfflBNMSlCiiBN*^:^ 
U^JP r S i&fF ^ 51 ^ <' tt> CO p< ;!3 X A ^ t, tl 

So Z(DXoU^ti=^Xlx\z\t. >''?^y ^y rfflBNM 
S:6s. £BNMS^f>/^^y ^T^y rfflBNMS-Ngift&tj 

twN C L=&tU^}#x.SAc^i^>^^)^^;6s^^tlTV^-^>o ^^-J 
^-r-jymh^ust^^^y b '7-^cDWli^5(ti^<' 
i:. iBNMScO®iiJ^£§| t^<'Ci:(c:^^5o 
50 [0 0 10] -^^(DJ^^y^Tv r ffl B N M S ^b^^ b N M 
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[0 0 11] 

^A^Tnto tUt>^. (1) S^^m^^:^ hU-P (B 

N) li:. (2) miizm^^mitx^xmi.fz^'py 

jtjJVJL'-V'-^ >^ — y=^-7. (GUI) ^y^>>^y^I:. 
2t. (3) ATM;1/-^2 0<£fflV>TDS 3 U>i57^ 
:fM.T. BN 1 k:g^^ni>7;t-;i/b M.'^V h BN 

[0012] y^^-JlY Mx^>bBNMS3(i. ^B 
NMS 4 i:M^;;^r>;/riBBNMS 5 A^^ffiSo ±BN 
MS 4 r^BNMS 5JiV^-rn*t. Sl^M 

1 $)Si>(iS2cD7^-^^-^l?— >'^- 1 0 ^i$> 
5V^{iS2CDx-^^-;^ 1 li:*fiixTl^^o 

[0 0 13] ±^±\-f u^v-T-jy') 
i^^^^Ai&f^Hir&B^Kifi. 1 ^^^^ 

L$iJ®)-rS C i: ct oT^S^fe B NM S ^ bTS/^^-r ^ 

f^V>^ (0 3cDjas^V>^O) ±T^^;/ hu-^m^ 

(NE) 1 2;t)>^w®i&^sa-r-5i:. ±bnms 

— ^-V— ( C o mma n a & e r ) i 
BNMS4^j[2;^^^^y (BN) 1 i:®F^tC^ 

^:/Yu-^mmv>^ (NCL) is^mmr^. m2 

:^J:V^3\zm^ti^Xo\z. NCL 1 3(i{S^>'^^^y h 
2-3®{K^U>^. -r^t)*>. NCL 

0 (T' KU;^ I PA 1 ^ I PAXCDF^tCV^;/ tr>^^ 
tls CCTIPA(i-r — bT'D h^^l/T'HU^ 
^^t?r) i:s NOLI (r KL.^ I PA2 i: I PAY 

f@CDj^lgV>^ (III3 (C:^rAL) ^ V 1: ></^nT 
V^^o *fi?»JtC:fel^T{i^ §NCL(i6-3®®^gU>^{3 
Vu/ l^>^*^^TV^SiP. CCD^';^7^A^. IflCDNC 

L 1 3tci zm-r^xomf^v >^^'^v}^y^^^x 

o\zm%\t^Z.h^-^^X^^o BNMS4. ShBN 

1 hcDP^tiNCL 1 3t^lf:(OXo\z\^xm^^ti^iy' 
\t. \ix-T^zmm\zm-<^^o 

(0014) 7^^m\zmim(o av^— i^-^^—j {i. 

BNMS4. SF^COSflCOV 7 h '^aiT^i^i— ;b 

h) or) 1 •PT^'So ^CD!ailI(iBNMS 4. 5 
ilBN 1 F^CDNE 1 2 {ATMy.-( ^y^Ulfl) b,(Df^\Z 
^ ^y-fe-i^ilM^S^L. mmf^CihX^^o NEl 
2l!)^e)COt--^T(7)^&i^*5ctlfBNMS 4. 5-NCD/i&^ 
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[0 0 1 5] iBNMS44S:^,±(^fcS. >'^^;/^:p^> 
>^fflBNMS 5 *s r A;^i^>>'W J ^-b'Tii:-^ 
±(:f?>tLSo ^^7t—hy.i^>j^>( J l + l:7;t — 
;i/b h h^jgcD i^T-fe ti. J^^:/ ^y^yy^y.'r 

(DX$>^ifi. mmt^m<Dm<Di^y.9-ixX0^W^iZiii^mr^ 

i^^— ;i/CD^ tHi<^±b:t^^T*fe ti . /^^y^r 
r ffl B N M S 5 i>s a 4 § [ t I ^ ^ « S { b ^ tt 

So 

[0 0 16] iifectt^^^^^/^T^y rffiBNMS©|5l^ 
±BNMS 4®»$RFJ::. i7 7^>> B NM S 5 jS?^ 

t)*>>'^^y ^^r^^rf^— ;^ 1 1 b(i. 

>^ 1 1 ai:C0H^^:i^i^§UTl^^ltn{^^cC^,^l^o CltD 
c:i:{i^BNMS 4 lc:fcttSn^tej^v^-e^^-8 a 
i:. S^fflv^-i>'-\'-6 ah. ^mmV'-J^-7 a. 

^BNMS 4tC:fel>T3 ^ b^tlShx ^O^^jlx' 
atc*5V^-rn<^A:^*5fTt>nSo ^m^^ffl 

^mmm^—y^~ 7 eiizMi^x. j^y^y^^yy-mm 
mmi)—^^-7 hizy'—^^-y. h5^>^^i^3>^m 

oT/^^y ^^T'^y rMT^— X 1 1 btcn tr— rs J: 

[0 0 17] BNMS^^^ifectt/iKi^l^m 
114^#,^'rSi:s ^BNMS 4 h^-^'^/^r 'vr^BN 
MS5{^. — 1 3 Toi — s;3i> h J 1 

BNMScD{ijsttsi^^:ii'><^-rso -r^t>t>. /^W&*J 

•T) -T^ — i^^—l 3 — i^:ii> b 1 4CDV^ h 
[0018]1ttC, V^-^^-^'- 1 3 fcji-S^xy b 1 
y^iy7s'rIx<OTy'^)^ — iy3>vyV^3LT2a.^ 9b 

©^^:??^c?^^£rSo ^M(D^^\zti\*^x. ^bnms4 

*3ct:T/>'^-•y^T^y rfflBNMS 5cD&>^tC:fel>T. Ctv 
^ <D ;r r V ^ b CD p t> CD - CD ^;i>s^f^^tl ^ tlT V A 
So :rmBNMS 5 ^C*5V^T^iJl — i^'^> b 

1 4 b36SrSI*fb^n. ^BNMS 4tC:J;5V^T{iVJ^ — 

1 3 ^t^mmt-^nxuho -ys. j^^y^y^:;rm 

50 BNMS 5 l3:fe(ti)^/ft»-r-5) x'^ — i^A'- 1 3 b i:. 3£ 
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BNMS 4il*|j-Sx-S^a:> h 1 4 ah«i»±LTl^ 

outing c 1 oud) J ^^jaxTfrtoti^o 

1 9 (13 2 Jc^^-r) ipe>fi£SJESJ^^*> h 
9-^ (WAN) ^7j<^tzi^\z. ilftt9^ST-Ml^'t,K-& i^? 

[0019] ±BNMS 4 fcv't'y ^vrfflB.NMS 5 

^le (I PA 1 h I PA3^^£Ss) tm2(Dmmv 
^tiSo :in?>©iK;sy >^(±-ms:^ r^t:)*>^:^(Ri 

ymBNMS SO-C—V-^^y hyn—h (e theme 

t por X) mizmm^ti^o i-^<Df^mm^(Dmm 

[0 0 2 0] r^^^^i^-^r>7.j(Dm.^<^mv> 
^ 1 6±T% ^T'^yir^BNMS 5(Cj;oTg«5CD 
^a>«A5iBNMS 4 {li^^n^o ^BNMS 4**'t,yN'^y 
i^T^y rmBNMS 5-\CDi^iS(i. (elU^y 1 6± 
^j^^n^o iBNMS 4 7b^e.CDi^;g;!)5^ V^b'i/^ir 

^;/rffiBNMS Sti^'JV^ 1 6 Jit3J3iJ(7)ill^fe^ill . 30 
^BNMS 4 A*t)CD/;£;^*^-Do >''?^;; ^t?' >^ffi B NM 
S 5i»s-co2[Blg©ISfT(C^bT^BNMS 4tf^^(Of^^ 

^:?'^yrfflBNMS 5i>^mmt LX^BKMS A ^(D 
/^^§^:§lt^^):^V^a^tC|i. ^ B N M S 4 h>'^ ^ r 
^^r^BNMS 5 t<Dm<Dm2(D^mV >^ 1 7±T% 

[0 0 2 1 ] J^^y PT^ymB-NMS 5ifis ^BNMS 
4 ^ © i(l>« * 6 HI il^ U T S ^ ^) a o :t 
Its i:XTlzm^^^o\Z. ±BNMS 4*Si!Sl^bTl>^ 
hfil^L. NCL 1 3^:f «y h9-^«^^^l 2 tZ-b 
hr^yr-r2):ii:«:iJ;oT^BNMS 4(D®fJ^5lt 
iai<'o ±BNMS 4:6S6[D]MggbT (2-^cD7t;:^ 

{^mmV>^ 16. 1 7£D^'^?^:^5V^T 3 [m) >'^'y^7 7^ 

Zti^X^^XoiZ. T'^ — A^^^ UT^^'^y <>r ^y r 

[0 0 2 2 ] T^ — >*^— /Ji — >-*x > h^7;t-— ;U h 50 
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L Title of Invention 

FAULT TOLERAKT BROADBAND NETWORK 
MANAGEMENT SYSTEM 

2. ClaiiQS 

1. In a broadband network management system 
having a primary broadband network management 
system for managing through a first network 
communication link a broadband network made up of 
at least one network element, and having a backup 
broadband network management system interfacing 
with said primary broadband network management 
system, a method for providing automatic recovery 
in response to a fault condition in the primary 
management system, comprising the steps of: 

creating a second network communication link 
between said backup broadband network management * 
system and said at least one network element in 
said broadband network in response to the fault 
condition in the primary broadband network 
management system; 

activating the backup broadband network 
management system so that it takes over the role of 
managing the broadband network through the second 
network communication link, 

2 . A method for providing automatic recovery 
as in claim i, prior to startup of the broadband 
network management system, including the further 
steps of: 
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prestoring at least one internet protocol 
address in a first table located in the primary 
network management system; 

prestoring at least one internet- protocol 
address in a second table located in the backup 
network inanageioent system. 

3 . A method for providing automatic recovery 
as in claim 2, wherein the first network 
communication link is defined by the at least one 
internet protocol address stored in the first table 
in the primary network management system; and 

wherein the second network communication link 
is created using the at least one internet protocol 
address stored in the table in the backup broadband 
network management system. 

4 . A method for .providing automatic recovery 
as in claim wherein upon activation of the 

backup broadband network management system, the 
backup broadband network management system assumes 
the role of the original primary broadband network 
management system. ■ 

5. A method for .providing automatic recovery 
as in claim A, wherein upon correction of the" 
original primary broadband network management 
system, the original primary broadband network 
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management systeio assumes the role of the backup 
broadband network management system. 

6, A nethod for providing automatic recovery as in claim 

further comprising the steps of: 

monitoring both the primary broadband networX management 
system and the backup broadbancl network management system for 
faults using fault tolerant mechaniems basaa on managar and agant 
objects vhich reside both in the primary tarcadband netvork 
management i^ystem and in the backup broadband network management 
system* 

7 . A method for providing automatic recovery 
as in claim 6, further comprising the steps of: 

sending periodic heartbeat messages between 
the manager object in the primary broadband network 
management system and the agent object in the 
backup broadband network management system. 

8 . A method for providing automatic recovery 
as in claim 7, further comprising the steps of: 

detecting a fault condition in the primary 
broadband network management system when the agent 
object in the backup broadband network management 
system fails to receive a heartbeat on a periodic 
basis. 
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9 . A method for providing automatic recovery 
as in claim 6, wherein within each of the primary 
broadband network management system and the backup 
broadband network management system, only one of 
the manager object and the agent object is active 
at any given time. 

10. A nethod for providing autoiaatic recovery as in clain 8, 
after detection of a fault condition in the primary broadband 
network management system, further conprising the steps of: 

activating the agent object in the primary broadband network 
management system; 

deactivating the nanager object in the prinary broadband 
network management system; 

activating the manager object in the backup broadband network 
management system; 

deactivating the agent object in the backup broadband network 
management system; and 

initiating the creation of said second network communication 
link between the backup broadband network management system and 
said at least one network element in the broadband network using a 
<:offimserver object; 

wherein under normal operating conditions, the manager object 
in the primary broadband network management system and the agent 
object in the backup broadband network management system are 
active* 
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H. A nethod for providing autoaatic recovery as in claim 10, 
after creating said second netvorlc comiaunication liiDc between the 
backup broadband network management systen and said at least one 
network elenent in the broadband network, further ccraprising the 
step of: 

activating the at least one network comaunication link between 
the backup broadband network management sy&tem and said at least 
one network element in the broadband network, thereby switching the 
role of managing the broadband network from the primary broadband 
network management system to the backup broadband network 
management system, 

.12. A method for providing automatic recovery as in claim IX, 
wherein after the original primary broadband network management 
system is corrected, the original primary broadband network 
management system assumes the role of the backup broadband network 
management system. 

13. A method for providing automatic recovery as in claim 7, 
wherein the heartbeat messages are sent via a plurality of 
reduhdant physical links, 

14. A method for providing automatic recovery as in claim 6, 
further comprising the step of. raising an alarm when a fault is 
detected in the backup broadband network management system- 
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13. A method for providing automatic recovery as in clAim s, 
after detection of a fault in the primary broadband network 
nanagement system, further coBiprising the steps of: 

sending a restart signal from the manager object in the 
primary broadband network managraent system to the agent object in 
the backup broadband network nanagement system; 

sending an acknowledgment signal from the agent object in the 
backup broadband network management system to the manager object in 
the primary broadband network management system; 

activating the agent object in the primary broadband network 
management system; 

deactivating the manager object in the pritnary broadband 
network management system; 

activating the manager object in the backup broadband network 
management systeia; 

deactivating the agent object in the backup broadband network 
management system; and 

initiating the creation of said second network communication 
link between the backup broadband network management system and 
said at least one network element in the broadband network using a 
commserver object; 

wherein under normal operating conditions, the manager object 
in the primary broadband network management system and the agent 
object in the backup broadband network management system are. 
active. 
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1-6. A method for providing automatic recovery as in clain 15, 
after creating said second network cosoaunication link between the' 
backup broadband network management system and said at least one 
network element in the broadband network, further comprising the 
step of.: 

activating the at least one network communication link between 
the backup broadband network management system and said at least 
one network element in the broadband network, thereby switching the 
role of -managing the broadband network from the primary broadband 
network management system to the backup broadband network 
management system. 

17. A method for providing automatic recovery as in claim 16, 
wherein after the original primary broadband network management 
system is corrected, the original primary broadband network 
management system assumes the role of the backup broadband network 
management system. 

18 . A broadband network management system for., aanaging a 
broadband network made up of at least one network element, and for 
providing automatic recovery in the event of a failure, comprising: 

a primary broadband network management system having a first 
address table containing at least. one pre-stored internet protocol 
address; . . 
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a backup broadband network saanagenent system- having a second 
address table containing at least one pre-stored internet protocol 
address; 

a first network coanunication link* between said primary 
broadband network nanagenent system and said at least one network 
element in said broadband network; 

said first network coanunication link being defined by said at 
least one pre-stored internet protocol address stored in said first 
address table; and 

a second network covoounication link between said backup 
broadband network management system and said at least one network 
element, said second network conmunication link being defined by 
said at least one pre-stored internet protocol address stored in 
said second address table, and being created upon failure of the 
primary broadband network nanagement system; 

thereby causing the backup broadband network management system 
to take over the role of managing the broadband network. . 

19. The broadband network management system as in claim 16, 
further comprising: 

a plurality of redundant physical links connecting said 
primary broadband network management system and said backup 
broadband network management system. 
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20. Ihe broadband network nanageinent system as in claim 18, 
vhereiti upon activation of the backup broadband network nanageneivt 
systen, the backup broadband network nanagement system assumes the 
role of the prinary broadband network management system • • 

21. The broadband network management system as in claim 20, 
whereupon correction of the original' primary broadband network 
nanagement system, the. original primary broadband network 
management system assumeis the role of the backup broadband network 
management system. 

22. The broadband network management system as in claim 18, 
further comprising; 

a fault monitoring means, for monitoring both the primary 
broadband , network management system and the backup broadband 
network management system for faults; 

said fault monitoring means comprising: 

a first fault detector in said primary broadband network 
management system; and 

a second. fault detector in said backup broadband network 
management system for communicating with said first fault detector 
over said redundant physical links*. 

23. The broadband network management system as in claim 22, 
wherein said first fault detector comprises a first manager object 
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and a first agent object, only one of which is active at a tiao; 
and 

wherein said second fault detector coxprises a second manager 
object and a second agent object, said second manager object being 
active when said first agent object is active, said second agent 
object being active when said first manager object is active. ~ 
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3. Detailed Description of Invention 
Field of the Invent:ion 

This invention relates to a fault tolejrant 
broadband' network nanagenent 'system, and noro 
particularly to a system having primary and backup 
architecture used to effect automatic recovery in 
the event of a catastrophic failurel 

Description of the Prior Art 

Broadband Network Management Systems (BNMS) 
are used to monitor and control the operation of 
the network elements within a Broadband Integrated 
Services Digital Network (B-ISDN) . The network 
elements, which include Asynchronous Transfer Mode 
(ATM) switches and ATM multiplexors /concentrators, 
provide high-speed/high bandwidth data, video, 
image, and voice transmission, ATM is a packet- 
switched network architecture which forms the core 
of the B-ISDH architecture. 

In the past, when a fault occurred in a 
Network Management system (NMS) , the network 
administrators lost the capability to monitor and 
control the network until the fault was corrected. 
In other words, the NMS was not fault tolerant. 

Recent NMSs, especially those used in computer 
networks, employ "distributed" architecture- 
Distributed architectures allow for distribution of 
the NMS's "processing" capability over more than 
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one computing machine. While such architectures 
allow for increasing the processing power of nms^ 
they do not provide fault tolerant capabilities. 
Thus, if one of the machines in the distributed 
architecture fails, then the functionality provided 
by that machine is lost. 

Moreover, in these distributed architectures, 
TCP/IP (Transmission Control Protocol / Internet 
Protocol) link switching was performed by slow and 
complicated routing topologies such as those 
described in "Establishment of isolated Failure 
Immune Real-Time Channels in HARTS", February 199 5, 
pp. 113-119, and "TCP/IP-Based Data Transport 
Services for LAN/WAN Interconnection", January 
1992, pp. 15-17 • 




An object of this invention is the provision 
of fault tolerant capability for BNMS which can 
effect automatic recovery, without disiruption of 
service, in the event of a catastrophic failure. 

Another object of this invention is the 
provision of fault tolerant capability for BNMS 
that incorporates TCP/IP (Transmission Control 
Protocol / Internet Protocol) link switching which 
uses software techniques which are simple, cheap, 
and fast. 
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Another object of this invention is the 
provision of fault tolerant capability for BNMS 
that can be easily manufactured • 

Briefly/ the architecture of this invention is 
based on a primary and backup BNMS in which the 
database in the backup BNMS is ' kept synchronized 
with that of the primary BMMS via replication data 
servers in each BNMS. The architecture also uses 
a set of redundant Network Communication Links 
(NCLs) over which the BNMS communicates with the 
network elements (e.g. , sends commands, receives 
responses to those commands, as well as receives 
autonomous messages) . if there is a fault in the 
primary BNMS causing a failure of communication 
between the primary BNMS and the Broadband Network 
(BN) f mechanisms are provided for the backup BNMS 
to take over the operation of monitoring and 
controlling the BN* Included within these 

mechanisms are means for the backup BNMS to switch 
over the NCLs from the primary BNMS to the backup 
BNMS automat ically* When the backup BNMS takes 
over the management of the network, it assumes the 
primary BNMS role. 

■When the original .primary BNMS becomes 
operational again, it assumes the role of the 
backup BNMS, since the original backup BNMS has 
assumed the primary BNMS role. These roles as well 
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as the NCLs can be switched for each occurrence of 
a fault. 



FIGS. 1 and 2 show three subsystems: (i) the 
Broadband Network (BN) x, (2) the Graphical User 
Interface (GUI) subsystem 2 shown as terminals in 
FIG. 1, and (3) the Fault Tolerant BNMS 3 which is 
connected to the BM 1 through PS3 linJcs using ATM 
routers 20. Only the third of the subsystems, the 
BNMS 3, is germane to this invention. 

The Fault Tolerant BNMS 3 consists of a 
primary BNMS 4 and a backup BNMS 5. Both the 
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primary BNMS 4 and the backup BNMS 5 include a 
replication manager S, replication server 7, log 
transfer manager 8, application software 9, primary 
or secondary database server 10, and primary or 
secondary database 11. 

Foverup 

At the beginning of system operation, the 
primary BNMS 4, which operates as the main BNMS by 
monitoring and controlling the broadband network 1, 
is powered up first* Upon receiving a restart from 
a network element (NE) 12 on the restart/ heartbeat 
association link (association link 0 in FIG. 3), 
the commanager object, which is located within the 
applications box of the primary BNMS 4, establishes 
Network Communication Links (NCLs) 13 between the 
primary BNMS 4 and the Broadband Network (BN) i. 
As shown in Figures 2 and 3 , the NCL 13 is a 
virtual packet switched connection and consists of 
two virtual links, NCLO (mapped between addresses 
IPAl and IPAX, where IPA stands for Internet 
Protocol Address) and NCLl (mapped between 
addresses IPA2 and IPAY) , each of which map to six 
association links (ALs, shown in FIG. 3). In this 
example, each NCL maps to six. association links, 
however, the system can be designed such that all 
twelve association links map to a single NCL 13. 
The details of how the NCLs 13 are established 
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between a BNMS 4,5 and the BJ^ 1 will, be explained 
further below. 

"Corananager", which is unique to this 
invention/ is one of the several software modules 
(objects) within a BNMS 4,5. Its role is to 
establish and manage message communication between 
the BNMS 4,5 and the NEs 12 (ATM switches^ etc.) 
within the BN 1* All commands from and responses 
to the BNMS 4,5 from the NEs . 12 are funneled via 
the Commanager so that it can check messages for 
errors, as well. as distribute them to the correct 
software module. 

After the primary BNMS 4 is powered up, the 
backup BNMS 5 is powered up in the "warm standby" 
mode. "Warm standby" is a type of l+i fault 
tolerant architecture in which a backup system is 
loaded with all software modules, but only the core 
software modules and essential application software 
modules needed for system switchover during failure 
conditions are operating. The rest of the software 
modules are dormant, and are activated after the 
backup BNMS 5 takes over the operation. 

Synchronization of Primary and Backup bnms 
In order for the backup BNMS 5 to be able to 
quickly take over upon failure of the primary BNMS 
4, the secondary, or backup, database lib. must be 
kept synchronized with the primary database lla. 
One of ordinary skill would appreciate that this is 
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done via the Log Transfer Manager 8a, Replication 
Manager 6a, and Replication Server 7a in the 
primary BNMS 4, and the Replication Server 7b in 
the backup BNHS 5. When a database transaction is 
cottuaitted in the primary 4 , a log entry is made in 
the primary Log Transfer Manager 8a. The primary . 
Replication Manager 6a scans this log on a routine 
basis and commands the primary Replication Server 
7a to send the database transaction to the backup 
Replication Server 7b to be copied into the backup 
database lib. 

BKMS Monitoring and Fault Detection 
Referring to FIG. 4, the primary BNMS 4 and 
backup BNMS 5 are monitored for faults using fault 
tolerant mechanisms based on "manager" 13 and 
"agent" 14 software objects. These objects check 
the health of each BNMS via a "keep alive sequence" 
in which periodic "heartbeat" messages (represented 
by the arrowed dotted lines in FIG, 4) are sent 
between the manager 13 and the agent 14 software 
objects. 

More specifically, manager 13 and agent 14 
software objects reside both in the primary and in 
the backup system application software, 9a, 9b, 
only one of these objects is active within each of 
the primary BNMS 4 and backup BNMS 5 at any given 
time. The agent 14b is active in the backup ' BNMS 
5 and the manager 13a is active in the primary BNMS 
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A, while the corresponding manager l-3b in the 
backup BNMS 5 and the agent 14a in the primary BNMS 
4 are dormant. These objects monitor the "health" 
of their system as well as. of their mate system by 
periodically isending . a heartbeat message to the 
mate and making sure that they receive a heartbeat 
from the mate on a periodic basis. This heartbeat 
message exchange takes place over a "routing cloud" 
15. "Routing cloud" is a terminology used in the 
communications field to indicate a Wide Area 
Network (WAN) consisting of one or more data 
communication routers 19 (shown in FXG. 2) . 

The primary BNMS 4 and the backup BNMS 5 are 
connected by two redundant physical links, a 
primary 16 (consisting of IPAl and IPA3) and a 
secondary 17 physical link (consisting of IPA2 and 
IPA4J : These physical links are duplex, i.e. they 
provide two-way communications, and are connected 
between the etheirnet ports in the primary BNMS 4 
and the backup BNMS 5. Redundant physical paths 
are used so that failure , of one physical path does 
not cause the backup BNMS 5 to conclude that the 
primary BNMS 4 is faulty and unnecessarily start 
the "switchover" scenario ♦ 

During the "keep alive sequence", the first 
heartbeat is sent by. the backup BNMS 5 to the 
primary BNMS 4 on the primary physical link ie. 
The response from the primary BNMS 4 to the backup 
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BNMS 5 is sent over the same primary linX 16. if 
the response from the primary BbMS 4 does not come 
within a stipulated period of time, which is 
software adjustable, the backup BNMS 5 sends 
another heartbeat on the primary link 16 and awaits 
a response from the primary BNMS 4. If the backup 
BHNS S fails to receive a response from the primary 
BNMS 4 on this second attempt, it tries for a third 
time. If the backup BNMS 5 still does not receive 
a response from the primary BNMS 4, it will then 
repeat this cycle of three attempts on the 
secondary physical link 17 between the primary bnms 
4 and backup BNMS 5. 

If the backup BNMS 5 fails to receive the 
heartbeat from the primary BNMS 4 six times in a 
row, then it assumes that the primaty BNMS 4 is 
faulty and takes over the role of the primary BNMS 
4 by setting up NCLs 13 to the network elements 12, 
as will be described further below. on the other 
hand^ if the primary BNMS 4 fails to receive the 
heartbeat message six times in a row from the 
backup BNMS 5 (three times on each of the two 
redundant physical links 16,17J, it raises an alarm 
to let the network administrator know about the 
problem in the backup BNMS 5 so that the network 
administrator can take appropriate measures. 

while the manager/agent fault tolerant 
mechanisms are known in the art, using them as a 
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pair of objects in which one is active while the 
other is dormant is believed to be unique to this 
invention. 

The number of attempts on each physical link 
16,17 is software adjustable, but there must be a 
minimum of two, one on each physical link. The 
reason for the multiple attempts is that sometimes 
communication problems are of a short duration. 
Using this technique avoids unnecessary switchover 
between primary BNMS 4 and backup BNMS 5 due to 
such transient problems. 

The faults within the BNMS 4 , 5 may be software 
or hardware related. Any catastrophic software 
failures in the primary BKMS 4 are detected by the 
operating system or the core software which inform 
the Manager object 13a within the primary BNMS 4 of 
such failures. The Manager object 13 a then shuts 
off the Commanager object in the primary BNMS 4 and 
sends a restart message to the agent object I4b in 
the backup BNMS 5. As a result of shutting off the 
Commanager object, NCI* 13 communication between the 
primary BNMS 4 and the BN 1 is lost (momentarily), 
and the recovery process which, is described in the 
next section begins. 

If the primary BNMS 4 develops a hardware 
fault, the "heartbeat" communication from the 
primary BNMS 4 to the backup 5 is lost, * The 
heartbeat communication stops since the operating 
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system, core software^ and the* Manager object 13a 
in the primary BNMS 4 stop functioning due to the 
hardware fault. As a result^, the Agent object I4b 
in the backup BNMS 5 fails to receive six 
consecutive heartbeat nessages (the number is 
software 'adjustable) from the primary BNMS 4, 
assumes that the primary BNMS 4 is faulty, and 
begins the recovery process described in the next 
section » 

Some examples of catastrophic failures 
include: a) software object continues to fail after 
three attempts to "revive" the object, b) failure 
of operating system and .core software itself, c) 
failure of any of the components of the database 
system (Log Transfer Manager, Replication Server, 
Data storage hard disk system), d) failure of . 
processor within BNMS, and e) failure of memory 
within BNMS- 

Switchover After Fault Detection 

A unique aspect: of this invention lies in the 
recovery procedure which occurs after detection of 
a fault in the' primary BNMS 4, The recovery 
procedure can be triggered either when the Agent 
object 14b in the backup BNMS 5 receives the 
restart signal from the Manager object I3a in the 
primary BNMS 4 (as . in the case of a software 
failure described earlier) , or when the Agent 
object 14b falls to receive six consecutive 
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heartbeat messages (as in the case of a hardware 
fault- described earlier) . 

In the first case, where the restart signal is 
received, the Agent object 14b in the backup BNMS 
5 acknowledges the receipt of* the restart message 
and activates the dormant Commanager object in the 
backup BNMS 5 (it was dormant while the ComiDanager 
object in the primary BNMS 4 was alive) . As soon 
as the Manager object 13a in the primary BNMS 4 
receives the restart acknowledgement from the Agent 
.object 14b in the backup BNMS 5, it goes dormant 
and the Agent object 14a in the primary BNMS 4 is 
made active. 

In the second case, where the agent 14b in the 
backup BNMS 5 detects a fault in the primary BNMS 
4 due to failure to receive six* consecutive 
heartbeat messages, the restart/ acknowledgment 
process is bypassed and the agent 14b in the backup 
BNMS 5 immediately activates the commanager object 
in the backup BNMS 5* 

The activated Commanager in the backup BNMS 5 
initiates new NCI* connections 13 between the backup 
BNMS 5 and each NE 12, i.e. ATM switch (s) , in the 
BN 1 by a combination of interworking between the 
software and hardware of the backup BNMS 5 and the 
individual NEs 12. Referring to FIGS. 2 and 3, the 
process is started by the Commanager creating 
commservers 18b within the backup BNMS 5; for 
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simplicity, one cominserver 18b for each NE 12 in 
the BH 1* The function of the commservers 18 is to 
manage the 13 TCP/IP (Transmission Control Protocol 
/ Internet Protocol) association links. Each NCL 
13 consists of a group of twelve TCP/IP association 
links between commservers 18b within the backup 
BNMS 5 and the corresponding NE 12 (ATM switch 
shown in FIGS. 2 and 3] . 

As one of skill in the art would appreciate, 
these association links are set up using ethernet 
ports within the backup BNMS 5, special 
communication hardware called Gateway PAD (GWPAD, 
which is further explained below} in the NEs 12, 
and conimunicatlon protocol software within the 
backup BNMS 5 and the NEs 12, Of these twelve 
association links ^ four are used for' CMIP (Common 
Management Information Protocol) messages between 
the backup BNMS 5 and NEs 12, .four are used for 
FTAM (File Transfer Access Method) messages between 
the backup BNMS 5 and NEs 12 and four are used for 
Alarm/ Event Messages from the NEs 12 to the backup 
BNMS 5. 

After creating the commseryers 18b, the 
Commanager in the backup BNMS 5 sets up new NCLO/1 
connections 13 to each NE 12 within the BN 1 by 
using the addresses .IPA3 and XPA4 stored in the 
Commanager in the backup BNMS 5, rather than the 
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addresses IPAl and IPA2 stored in the Commanager in 
the primary BNMS 4 . 

The IP addresses IPAl and IPA2 are pre-stored 
in tables inside the Commanagers in the primary 
BNHS 4, and the IP addresses IPA3 and IPA4 are pre- 
stored in tables - inside the Cononanagers in the 
backup BNMS 5. Thus, by merely using the addresses 
IPA3 and IPA4 which are pre-stored in the backup 
BNMS 5 rather than the addresses IPAl and IPA2 
which are pre-stored in the primary BNMS 4, the 
NCLs 13 can be easily switched from the primary 
BNMS 4 (NOLO mapped from IPAl to IPAX; NCLl mapped 
from IPA2 to IPAY) to the backup BNMS 5 (NOLO 
mapped from rPA3 to IPAX; NCLl mapped from IPA4 to 
IPAY). In FIG. 3, the solid NCL arrowed lines 
represent the NCI»s before switchover, the dotted 
NCL . arrowed lines represent the NCLs after 
switchover. This process of switching the NCLs 
according to the present invention is much faster 
and simpler that the slow and complicated touting 
prior art topologies. 

After the communications between the backup 
BNMS 5 and the BN 1 are successfully established, 
the Manager object 13b in the backup BNMS 5 is made 
active and the Agent object l4b goes dormant. The 
NCLs 13 and twelve . association links are made 
active, and the backup BNMS 5 assumes the role of 
the primary BNMS by monitoring and controlling the 
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BH 1, thus switching the role of the original 
backup BNMS 5 to the primary BNMS role. 

When the original primary 4 BNMS is corrected, 
it assumes the role of the backup BNMS by 
activating its Agent object 14a and leaving its 
Manager object 13a dormant. This switching of 
roles between the primary and backup BNMS can thus 
occur ad infinitum* If for any reason, the NCL 
communications 13 between the backup BNMS 5 and the 
BN 1 can not be established, alarms are raised so 
that the network administrators can take 
appropriate manual corrective actions. 

The. primary/backup BNMS switchover is 
independent of the state of the primary BNMS 4 when 
the failure occurs. , In other words, the actions 
taken by the backup BNMS 5 are identical if the 
failure occurs while the primary BNMS 4 is sending 
a command, receiving a response to a command, 
receiving an alarm or event message, or just 
idling. 

Note that GWPAD is a known packet 
assembler/dis-assembler and is located within each 
of the NEs 12 in the BN 1, The commands sent by 
the BNMS are received as ATM (Asynchronous Transfer 
Mode) cells by the NEs 12. (NEC uses this 
technology. Other, technologies such as X.2 5 or IPX 
data packets could be used by other vendors to 
perform such communication between the BNMS and the 
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BN.) These cells are received by the GWPAO and 
converted into messages which are analyzed by the 
software vitliin the NEs 12, similarly, responses 
and alarm messages sent by NEs 12 are first sent to 
GWPAD, which then breaks them into ATM cells to be 
sent to the BNMS 4^5. 

While the invention has been particularly 
shown and described with respect to a preferred 
embodiment thereof/ it will be understood by those 
skilled in the art that the invention can be 
practiced with modification within the spirit dnd 
scope of the appended claims. 
4. Brief Description of Drawings 



The foregoing and other objects, aspects, and 
advantages will be better understood from the 
following detailed description of the invention 
with reference to the drawings, in which: 

FIGS. 1 and 2 are diagrams showing a fault 
tolerant broadband network management system 
according to the invention, 

FiGi 3 is a diagram showing connections 
between a broadband network management system and 
an ATM switch. 

FIG. 4 is a diagram showing "manager" and 
"agent" software objects accordiTig to the 
invention. 
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1. Abstract 

ABSTRACT OF THE DISCLOSDRE 
A fault tolerant broadband network management 
system (BNMS) having primary and backup 
architecture used to effect automatic recovery in 
the event of a catastrophic failure. The database 
in the backup BNMS is kept synchronized with that 
of the primary BNMS via replication data servers in 
each BNMS. The architecture also uses a set- of 
redundant Network Communication Links (NCLs) over 
which the BNMS- communicates with the network 
el-ements . If there is a fault in the primary BNMS 
causing a failure of communication between the 
primary BNMS and the Broadband Network (BN) , 
mechanisms are provided for the backup BNMS to take 
over the operation of monitoring and controlling 
the BN by switching over the NCLs from the primary 
BNMS to the backup BNMS automatically. When the 
"backup BNMS takes over the management of the 
network, it assumes the primary BNMS role. When 
the original primary BNMS becomes operational 
again, it assumes the role of the backup BNMS, 
since the original backup BNMS has assumed the 
primary BNMS role. These roles as well as the NCLs 
can be switched for each occurrence of a fault. 

2. Representative Drawing 



